Macro-script execution control

Abstract

An agent inserts one or more hooks into a sub-execution runtime environment that is configured to include a script and/or targeted to include the script. The agent including the one or more hooks monitors a behavior of the sub-execution runtime environment and/or the script. The agent subsequently obtains context information regarding the sub-execution runtime environment and/or the script so that it can control the runtime of at least the sub-execution runtime environment. Related systems, methods, and articles of manufacture are also disclosed.

What is claimed is: 
     
       1. A method, implemented by at least one computing device, comprising:
 inserting, by an agent, one or more hooks into a sub-execution runtime environment, the sub-execution runtime environment configured to include a script and/or targeted to include the script; 
 monitoring, by the agent including the one or more hooks, a behavior of the sub-execution runtime environment and/or the script; 
 obtaining, by the agent including the one or more hooks, context information regarding the sub-execution runtime environment and/or the script; and 
 controlling, by the agent, a runtime of at least the sub-execution runtime environment including the script, the controlling based on the monitored behavior of the sub-execution runtime environment and/or the script and the obtained context information regarding the sub-execution runtime environment and/or the script; 
 wherein:
 a first hook of the one or more hooks is installed so as to monitor an operating system functionality to detect what type of object is being imported and/or from where an object is being imported into the sub-execution runtime environment; 
 a second hook of the one or more hooks is installed so as to obtain context information relating to script execution; and 
 a third hook of the one or more hooks is installed into an operating system module and/or a script execution environment-related module as the operating system module and/or the script execution environment-related module are loaded into the sub-execution runtime environment. 
 
 
     
     
       2. The method of  claim 1 , wherein the one or more hooks are inserted into a runtime environment for a document, and wherein the script is embedded in the document. 
     
     
       3. The method of  claim 2 , wherein the agent inserts a plurality of hooks comprising code hooks into the sub-execution runtime environment for the script and the runtime environment for the document. 
     
     
       4. The method of  claim 1 , wherein at least one hook of the one or more hooks is placed in a dynamic link library to monitor calls made by the sub-execution runtime environment including the script. 
     
     
       5. The method of  claim 1 , wherein the context information comprises a file name, a file path, and/or a uniform resource locator. 
     
     
       6. The method of  claim 1 , wherein at least one hook of the one or more hooks stores the context information using a global variable to enable sharing the context information with the agent or another hook. 
     
     
       7. The method of  claim 1 , wherein the controlling comprises:
 obtaining, by the agent, policy information; and 
 determining, based on the monitored behavior of the sub-execution runtime environment and/or the script, the obtained context information regarding the sub-execution runtime environment and/or the script, the obtained policy information, and a remedial action to control the runtime of the at least the sub-execution runtime environment including the script. 
 
     
     
       8. The method of  claim 7 , wherein the remedial action comprises inhibiting execution of the script. 
     
     
       9. The method of  claim 7 , wherein the remedial action comprises allowing the script to execute with limited resources. 
     
     
       10. The method of  claim 1 , further comprising:
 inducing an error in execution of the script by at least modifying at least one argument of an intercepted function call. 
 
     
     
       11. The method of  claim 1 , further comprising:
 identifying and/or locating an interpreter of the sub-execution runtime environment; and 
 hooking the interpreter of the sub-execution runtime environment. 
 
     
     
       12. The method of  claim 1 , further comprising:
 monitoring a behavior of a process; 
 determining, based on at least one hook and the context information, whether the monitored behavior of the process is being performed by the process on behalf of a script; 
 obtaining information about the script; and 
 reporting the monitored behavior of the process and/or applying a remedial action to the process. 
 
     
     
       13. The method of  claim 1 , wherein the agent inserts at least one hook of the one or more hooks into the sub-execution runtime environment including the script before the script is loaded, run, and/or selected for loading. 
     
     
       14. The method of  claim 1 , wherein the agent inserts at least one hook of the one or more hooks into the sub-execution runtime environment including the script before the script is allowed to run and/or the script is called. 
     
     
       15. The method of  claim 1 , wherein the controlling, by the agent, includes preventing the script from being loaded, called, and/or executed. 
     
     
       16. A system comprising:
 at least one processor; and 
 at least one memory storing program code which when executed causes operations comprising:
 inserting, by an agent, one or more hooks into a sub-execution runtime environment, the sub-execution runtime environment configured to include a script and/or targeted to include the script; 
 monitoring, by the agent including the one or more hooks, a behavior of the sub-execution runtime environment and/or the script; 
 obtaining, by the agent including the one or more hooks, context information regarding the sub-execution runtime environment and/or the script; and 
 controlling, by the agent, a runtime of at least the sub-execution runtime environment including the script, the controlling based on the monitored behavior of the sub-execution runtime environment and/or the script and the obtained context information regarding the sub-execution runtime environment and/or the script; 
 wherein:
 a first hook of the one or more hooks is installed so as to monitor an operating system functionality to detect what type of object is being imported and/or from where an object is being imported into the sub-execution runtime environment; 
 a second hook of the one or more hooks is installed so as to obtain context information relating to script execution; and 
 a third hook of the one or more hooks is installed into an operating system module and/or a script execution environment-related module as the operating system module and/or the script execution environment-related module are loaded into the sub-execution runtime environment. 
 
 
 
     
     
       17. The system of  claim 16 , wherein the one or more hooks are inserted into a runtime environment for a document, and wherein the script is embedded in the document. 
     
     
       18. The system of  claim 17 , wherein the agent inserts a plurality of hooks comprising code hooks into the sub-execution runtime environment for the script and the runtime environment for the document. 
     
     
       19. The system of  claim 16 , wherein at least one hook of the one or more hooks is placed in a dynamic link library to monitor calls made by the sub-execution runtime environment including the script. 
     
     
       20. The system of  claim 16 , wherein the context information comprises a file name, a file path, and/or a uniform resource locator. 
     
     
       21. The system of  claim 16 , wherein at least one hook of the one or more hooks stores the context information using a global variable to enable sharing the context information with the agent or another hook. 
     
     
       22. The system of  claim 16 , wherein the controlling comprises:
 obtaining, by the agent, policy information; and 
 determining, based on the monitored behavior of the sub-execution runtime environment and/or the script, the obtained context information regarding the sub-execution runtime environment and/or the script, the obtained policy information, and a remedial action to control the runtime of the at least the sub-execution runtime environment including the script. 
 
     
     
       23. The system of  claim 22 , wherein the remedial action comprises inhibiting execution of the script. 
     
     
       24. The system of  claim 22 , wherein the remedial action comprises allowing the script to execute with limited resources. 
     
     
       25. The system of  claim 16 , further comprising:
 inducing an error in execution of the script by at least modifying at least one argument of an intercepted function call. 
 
     
     
       26. The system of  claim 16 , further comprising:
 identifying and/or locating an interpreter of the sub-execution runtime environment; and 
 hooking the interpreter of the sub-execution runtime environment. 
 
     
     
       27. The system of  claim 16 : further comprising:
 monitoring a behavior of a process; 
 determining, based on at least one hook and the context information, whether the monitored behavior of the process is being performed by the process on behalf of a script; 
 obtaining information about the script; and 
 reporting the monitored behavior of the process and/or applying a remedial action to the process. 
 
     
     
       28. The system of  claim 16 , wherein the agent inserts at least one hook of the one or more hooks into the sub-execution runtime environment including the script before the script is loaded, run, and/or selected for loading. 
     
     
       29. The system of  claim 16 , wherein the agent inserts at least one hook of the one or more hooks into the sub-execution runtime environment including the script before the script is allowed to run and/or the script is called. 
     
     
       30. The system of  claim 16 , wherein the controlling, by the agent, includes preventing the script from being loaded, called, and/or executed. 
     
     
       31. A non-transitory machine-readable medium storing program code which when executed causes operations comprising:
 inserting, by an agent, one or more hooks into a sub-execution runtime environment, the sub-execution runtime environment configured to include a script and/or targeted to include the script; 
 monitoring, by the agent including the one or more hooks, a behavior of the sub-execution runtime environment and/or the script; 
 obtaining, by the agent including the one or more hooks, context information regarding the sub-execution runtime environment and/or the script; and 
 controlling, by the agent, a runtime of at least the sub-execution runtime environment including the script, the controlling based on the monitored behavior of the sub-execution runtime environment and/or the script and the obtained context information regarding the sub-execution runtime environment and/or the script; 
 wherein:
 a first hook of the one or more hooks is installed so as to monitor an operating system functionality to detect what type of object is being imported and/or from where an object is being imported into the sub-execution runtime environment; 
 a second hook of the one or more hooks is installed so as to obtain context information relating to script execution; and 
 a third hook of the one or more hooks is installed into an operating system module and/or a script execution environment-related module as the operating system module and/or the script execution environment-related module are loaded into the sub-execution runtime environment.